Mobile viruses that spread through mobile phones are starting to appear, but the big mobile virus epidemic is still a long ways off.


"Getting infected with a virus via Bluetooth is interesting because it's akin to a human virus, which requires proximity to spread -- but it also severely limits how far the virus can go."


Every time I lose my mobile phone, which happens far too often, I'm given the opportunity to check out the latest and greatest phone technologies available. This is great stuff. They have zoom lenses for pictures and Quicktime videos, they have high resolution color screens, wireless data access for my laptop, they play MP3s, send emails, and even sync my calendar and address book wirelessly with my desktop. With Bluetooth, WAP, and mobile browsers, these are tiny computers with far more power than most people give them credit for.

With computing power comes security weaknesses, viruses and worms. Is no technology sacred from security threats? There is almost no consumer-level technology left where viruses and malicious code has failed to appear (the possible exception being a great source of envy, OS X). Mobile phones are becoming a vector of attack.

Mobile phone viruses?

At first glance, mobile phones might seem to have all the technology needed for a major virus outbreak in 2005. They have modern CPUs, built-in Bluetooth wireless technology, and data transfer across multiple networks. Many even ship with Java. By some estimates, up to half of these new "smartphones" leave the factory with some version of the Symbian OS, which is gaining in popularity because of endorsements by leaders Nokia, Eriksson, and others. With the worldwide market for mobile phones still growing at a phenomenal 32% in 2004, and with an estimated 1.5 billion people (or 1/4 of the world's population) already owning a mobile phone, virus epidemics that target mobile phones will one day become a reality. But what about in 2005?

The first proof-of-concept mobile phone virus appeared in June 2004 for the Symbian OS, but as proof of concepts tend to be, it proved relatively harmless. Subsequent versions have significantly improved capabilities, but they're still very low risk. Most interestingly, they all use Bluetooth to propagate. Bluetooth is a great technology for connecting small devices that are close to one another, but therein is also its disadvantage: with a few exceptions, the technology has a very limited range. With Macs and PCs, Bluetooth lets you connect your mobile phone, PDA, and laptop to your printer. It lets you sync your calendar and address book, and of course, allows for the transfer of arbitrary data.

Getting infected with a virus via Bluetooth is interesting because it's akin to a human virus, which requires proximity to spread -- but it also severely limits how far the virus can go. As newer variants get smarter, however, they'll start to use the phone's GPRS-style data capabilities to spread. After all, they have immediate access to the address book inside your mobile phone.

Why should one care about mobile phone viruses? There is clearly a profit motive, and that's all that is needed to kickstart another dubious industry. From a virus that will dial 1-900 numbers all day long, to the one that automatically buys a hundred ringtones that get added to your phone bill, there is money to be made by the next wave of miscreants. In Asia, telcos have already begun testing e-commerece transactions that are available through your phone. Where there's e-commerce, you can bet there will be viruses and security threats. With such embedded purchase power, I'd hate to think what would happen when I lose that phone.

However, the reality is that the real threat from viruses just doesn't exist today. My prediction is that mobile phones won't experience any major security issues for several years, for the same reasons that we don't see major virus threats in the computer world for any platform other than Windows: there needs to be a critical mass of a given population for the threat to be real. Today there are too many different competing phone technologies, operating systems and architectures for there to be any clear winner.

If the same were true in the computer security world, there would be far fewer viruses than there are today.

I would suggest that the best reason why mobile viruses won't become an issue for some time is the wide array of different phone models, network technologies and embedded operating systems. In short, we have still have choice.

Cellphones have been with us for a long time, but in a way the wireless industry feels like the computer industry was back in the 1980s: many proprietary systems that do interact, to some extent, without any one clear technological winner. With at least 30 mobile virus variants today for the Symbian OS alone, I think many people will be surprised at how easy it will be to carry around malcode clipped to our belt in the years to come.

Kelly Martin has been working with networks and security since 1986, and he's editor for SecurityFocus, Symantec's online magazine.